Odoo 17 · 18 · 19 · payment_coriunder

A Coriunder payment provider for Odoo, versioned like Odoo is.

Separate packages for Odoo 17, 18 and 19 — each built against that release rather than shimmed for it. The shopper pays on the Coriunder hosted page and a signature-verified webhook confirms the transaction.

17 · 18 · 19
Odoo versions
25
Currencies
HTTP 401
On bad signature
What you get

Built for Odoo, not ported to it

Installed from Apps like any other Odoo module, configured on the standard Payment Providers form.

Hosted payment page

Odoo creates the payment transaction and redirects the browser to Coriunder. Card entry and 3-D Secure happen entirely off-platform.

Signature-verified webhooks

Every webhook is verified with hmac.compare_digest. Invalid or missing signatures are rejected with HTTP 401.

25 supported currencies

ILS, USD, EUR, GBP, AUD, CAD, JPY and 18 more. The payment method is hidden at checkout for any currency outside the list.

Three-state transaction flow

Reply 000 marks the transaction Done, 553 holds it Pending while 3-D Secure runs, and anything else becomes an Error.

No sandbox credentials

The 17, 18 and 19 packages ship without sandbox credentials and reject Odoo Test mode, so a live provider cannot quietly run against a test endpoint.

Version-matched packages

Separate builds for Odoo 17, 18 and 19 on Python 3.10+, rather than one module trying to satisfy three releases.

How it works

From cart to confirmed order

The full flow, from the Pay button to the payment status page.

Customer clicks Pay

Odoo creates a payment.transaction and moves it from draft to pending.

They are redirected

The browser is sent to the Coriunder hosted payment page, where card details are entered and 3-D Secure runs if enabled.

Coriunder calls the webhook

A POST to /payment/coriunder/webhook carries the reply code, transaction reference and signature.

The transaction resolves

Signature verified: 000 becomes Done, 553 stays Pending, anything else becomes Error, and the customer sees the payment status page.

Built for trust

A public endpoint that trusts nothing

The webhook has to be publicly reachable for Coriunder to call it, so every request is treated as untrusted: the signature is verified with a constant-time comparison before any transaction state is touched.

The module declares a deliberately narrow scope. Immediate sale and capture only — authorization, manual capture, refunds, tokenization and express checkout are not declared, so Odoo will not offer them.

See the technical documentation
  • Constant-time verification. Signatures are compared with hmac.compare_digest.
  • Unsigned requests rejected. Invalid or missing signatures return HTTP 401 and change nothing.
  • Test mode refused. The packages contain no sandbox credentials and reject Odoo Test mode.
  • Currency gating. The method is hidden at checkout for any currency outside the supported list.
  • Narrow scope. Only immediate sale/capture is declared; unsupported operations are never offered.
  • HTTPS hosted page. The hosted payment URL is confirmed as HTTPS during configuration.
Requirements

Check your store in ten seconds

Packages are published per Odoo major version.

RequirementSupported
Packagespayment_coriunder for Odoo 17.0, 18.0 and 19.0
Python3.10+
AccountMerchant ID + Personal Hash
WebhookPOST https://your-odoo-domain/payment/coriunder/webhook — public, but every request is signature-verified
ScopeImmediate sale/capture only. Authorization, manual capture, refunds, tokenization and express checkout are not declared
CurrenciesILS, USD, EUR, GBP, AUD, CAD, JPY, NOK, PLN, MXN, ZAR, RUB, TRY, CHF, INR, DKK, SEK, CNY, HUF, NZD, HKD, KRW, SGD, THB, BSD
Installation

Live in four steps

Copy, install, configure — the standard Odoo module path.

Copy the module

Place the payment_coriunder directory into your Odoo addons path and restart the server.

Install

Go to Apps, search for Coriunder and click Install.

Configure

Open Accounting → Configuration → Payment Providers → Coriunder and enter the live Merchant ID and Personal Hash.

Connect the webhook

Confirm the HTTPS hosted-payment URL, select a display language, enable the provider, and point Coriunder at your webhook URL.

Questions

Frequently asked

Which Odoo versions are supported?

Odoo 17, 18 and 19, each with its own package built against that release. A legacy single-version copy is kept under odoo/old/.

Can I run it in Odoo Test mode?

No. The packages contain no sandbox credentials and reject Odoo Test mode by design.

Which currencies work?

25 currencies including ILS, USD, EUR, GBP, AUD, CAD and JPY. For any other currency the payment method is hidden at checkout.

Does it support refunds or tokenization?

No. The module declares immediate sale and capture only. Authorization, manual capture, refunds, tokenization and express checkout are not declared.

Is the webhook endpoint safe to expose?

Yes. It is public because Coriunder must reach it, but every request is signature-verified and unsigned requests are rejected with HTTP 401.

Which logo is shown?

The standard Odoo provider image on the payment provider form. Nothing ships with the module and no fallback is used.

Ready to accept payments?

Download the package matching your Odoo version and connect your instance to Coriunder.